Live › vulnerability › CVE-2026-121425
Nodemailer's addressparser ends RFC 5322 group addresses early at a semicolon inside quoted names or comments. An attacker can submit crafted addresses that pass validation and redirect mail to recipients of their choosing, bypassing allow lists.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 15:21 UTC. All times on this page are UTC.
Applications that use Nodemailer to send mail and accept addresses from users, or that rely on recipient allow lists enforced by its address parser. Apps that send only to hardcoded internal addresses are much less exposed. unknown whether other sources add further detail.
No product ranges from the sources yet.
npm ls nodemailer and compare it to the fixed range.nodemailer below 10.1.4.10.1.4 or later (affected range is 3.0.0 up to but not including ).10.1.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.
This page as .md · .json · in your agent: get_signal("CVE-2026-121425")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.